# PhishDestroy domain threat record: aj.sn9long.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/aj.sn9long.com/ Machine-readable companion: https://phishdestroy.io/domain/aj.sn9long.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-07 19:03:51 UTC - Last availability or vendor check: 2026-10-22 10:24:37 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 9/89 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: flagged ## Stored classification - Targeted brand: MetaMask ## Stored infrastructure - Observed IP address: 104.233.148.222 - Registrar in stored WHOIS data: Gname 478 Inc - Last stored HTTP status: 200 - Registration date (registry RDAP, sn9long.com): 2026-06-07 18:19:10 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/aj.sn9long.com - Certificate Transparency search: https://crt.sh/?q=%25.aj.sn9long.com - Web Archive lookup: https://web.archive.org/web/*/https://aj.sn9long.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview aj.sn9long.com is an impersonation phishing page dressed up as the official download portal for a major crypto exchange. Its Chinese title, "o易交易所app下载官网", swaps one character in 欧易, OKX's Chinese brand name, and promises a stablecoin zone for USDT with low volatility. The page targets Chinese-speaking traders. PhishDestroy first saw it on 2026-09-07, and it was still live and serving content on 2026-10-19. How the scam works Fake exchange download portals of this kind rely on users searching for the app and trusting a page that looks official. The visitor is pushed to install an app or open a trading interface that the operators control. That fake app or login screen can capture exchange credentials and recovery phrases, or show a convincing balance so the victim keeps depositing USDT. The appeal of a "low-volatility stablecoin" section makes depositing feel safe. Money sent through such a platform goes to the scammers, and later requests to pay "fees" before a withdrawal are part of the same theft. Evidence On 2026-09-14, 9 of 89 VirusTotal engines flagged the domain, including Google Safe Browsing, Fortinet, Forcepoint ThreatSeeker, Netcraft, Emsisoft, Gridinsoft, CRDF and SOCRadar. That is a modest share of engines, but the vendors come from independent sources. Google Safe Browsing classifies the site as social engineering, which means browsers using it should show a warning. The domain also appears on the MetaMask and SEAL blocklists alongside PhishDestroy. Infrastructure The domain was registered on 2026-06-07 through Gname 478 Inc, three months before PhishDestroy detected it. That gap fits a domain held in reserve or used quietly before it drew attention. It resolves to 104.233.148.222 on the PEG TECH INC network in the United States. The free Let's Encrypt certificate gives the page a padlock, which says nothing about whether the operator is legitimate. What to do Do not install anything from this site. If you already did, delete the app and remove any configuration profile it added. If you logged in with real exchange credentials, change your password from the genuine app, reset two-factor authentication and review active sessions and API keys. If you typed in a recovery phrase, move your funds to a new wallet immediately. Do not send money to unlock a "withdrawal". Defenders should block the domain and its IP and warn users that 欧易 and OKX apps should only come from official app stores. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/aj.sn9long.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=aj.sn9long.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:48:04 UTC ## Stored page captures - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/08b1fc07-3d06-4382-9ceb-895fc9caab3e.png Captured: 2026-09-13 00:21:36 UTC Source report: https://radar.cloudflare.com/scan/08b1fc07-3d06-4382-9ceb-895fc9caab3e SHA-256: d54ac0f812676a639bcd25854c2eabcf607cdcdae10ee364acde4d82768e62c2 - URLScan · 2026-09-07: https://screenshots.phishdestroy.io/us/01a07d43-d695-7189-95ee-c37ac41ca376.png Captured: 2026-09-07 19:07:06 UTC Source report: https://urlscan.io/result/01a07d43-d695-7189-95ee-c37ac41ca376/ SHA-256: 9c9e81e1d5ca43370ae24aabd7dcc0a7da6806818da4f83a6ae8843ef9881475 - URLScan · 2026-09-07: https://screenshots.phishdestroy.io/us/01a07d48-bb80-7390-a090-33b4de9a694f.png Captured: 2026-09-07 19:12:28 UTC Source report: https://urlscan.io/result/01a07d48-bb80-7390-a090-33b4de9a694f/ SHA-256: 8c936ed34764c7bd9c42464b66ee390e191b51e766f7925d81e0917fd8f1962a ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-21T02:30:18Z", "uuid": "08b1fc07-3d06-4382-9ceb-895fc9caab3e", "scanned_at": "2026-09-13T00:21:36Z", "final_url": "https://aj.sn9long.com/", "status": 200, "redirected": "https-only", "history": [ { "url": "http://aj.sn9long.com/", "status": 307 }, { "url": "https://aj.sn9long.com/", "status": 200 } ], "dom_hash": "bf1c3e9438c6e5de9978cc0818f5f673d474895682e007d00f655fe8fe74ae50", "doc_hash": "8897aca1dc47b75937bf2d59913176fff5161883fb33f30b5ad55bda75c376a2", "phishing_v2": [ "phishing" ], "url_risks": [ "Phishing" ], "domain_risks": [ "Phishing", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "aj.sn9long.com", "type": "A", "value": "104.233.148.222" } ], "dnssec_valid": false, "ip": "104.233.148.222", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "Gname 478 Inc", "created": "2026-06-07T18:19:10Z", "updated": "2026-08-24T07:57:12Z", "expires": "2027-06-07T18:19:10Z", "nameservers": [ "sara.ns.cloudflare.com", "seth.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T14:52:41Z", "analysis_at": "2026-10-08T15:33:24Z", "stats": { "timeout": 0, "harmless": 44, "malicious": 12, "suspicious": 2, "undetected": 34 }, "detections": { "CRDF": "malicious", "ESET": "suspicious", "G-Data": "phishing", "Sophos": "phishing", "Webroot": "malicious", "Emsisoft": "phishing", "Fortinet": "phishing", "Netcraft": "malicious", "SOCRadar": "phishing", "Gridinsoft": "suspicious", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Google Safe Browsing": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "registrar": "Gname 478 Inc", "created": "2026-06-07T18:19:10Z", "expires": "2027-06-07T18:19:10Z", "updated": "2026-08-24T07:57:12Z", "first_seen": "2026-09-07T19:10:26Z", "dns": [ { "ttl": 300, "type": "A", "value": "104.233.148.223" } ], "dns_at": "2026-10-08T16:28:24Z", "jarm": "3fd3fd0003fd3fd00042d42d0000002059a3b916699461c5923779b77cf06b", "cert": { "san": [ "*.cdgnt.cn", "*.cdylyj.cn", "*.cloudsbao.cn", "*.cspiu.cn", "*.ctdjxx.com", "*.cykyz.com", "*.dachenggd.com", "*.dyjrwx.com", "*.gblvtw.cn", "*.gtvgv97.cn" ], "issuer": "Let's Encrypt / YR1", "serial": "5916b5b81b5ba9f53b8bb0e284f0c2a7f45", "sha256": "8fe632c824513f144f34e796d31eea7393cc45e1b398d9372123268ad7af6ab6", "subject": "ycxcjzx.com", "valid_to": "2026-12-11T13:02:56Z", "valid_from": "2026-09-12T13:02:57Z" }, "whois": { "registrar": "Gname 478 Inc", "registrar_iana_id": "4520", "registrar_url": "http://www.gname.com", "created": "2026-06-07T18:19:10Z", "updated": "2026-08-24T07:57:12Z", "expires": "2027-06-07T18:19:10Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "sara.ns.cloudflare.com", "seth.ns.cloudflare.com" ], "dnssec": "unsigned" } } } ```